Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Synapse Safe?

SYNEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades1/10Checks passed1 of 5Findings1 High · 1 Medium · 1 Low · 2 Info5
SummaryAI Copilot

This audit was conducted on a partial source code fragment, specifically the AccessControlUpgradeable contract, which is a dependency for the SynapseERC20 token.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract
  • Non-standard proxy storage
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top3 unlocked holders = 93.5%
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Non-standard proxy storage (Etherscan-confirmed)
  • Top-10 concentration > 50% (68.7% total → 54.0% effective; 44.2% in EOAs, 24.4% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top3 unlocked holders = 93.5% (independent LP — depth risk, pool = 98% of DEX liquidity)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 41 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable

Holders

as of audit · Sep 4, 2026
24.4%Contracts44.2%Wallets31.3%Everyone else
24.4%Contracts44.2%Wallets31.3%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
68.7%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking24.4%
  • Walletsanonymous holders, free to sell44.2%
  • Everyone elsethe rest of the supply31.3%
Effective concentrationwhat the score reads54.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$117.0K across 6 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$114.3KShare of depth97.7%
Top-1 Unlocked Holder44.3%
Top-3 Unlocked93.5%
Unlocked LP held by
0xd10e…62cf0x3887…7f1c0x9d5b…992d0x8315…043e0x08a1…4b510xb355…034d0x0cf0…4fd60x1e96…18d00x9728…8a210xe41a…2017

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium1 Low2 Info
High

Incomplete Audit Scope Due to Partial Source Code

The audit was conducted on a fragment of the project's source code, specifically the AccessControlUpgradeable.sol contract. The main SynapseERC20 contract, which would integrate this access control, was not provided. This limitation prevents a comprehensive security assessment of the entire protocol, meaning potential vulnerabilities in the core logic, interactions, or other components of SynapseERC20 could not be identified.H-01

Issue

The audit was conducted on a fragment of the project's source code, specifically the AccessControlUpgradeable.sol contract. The main SynapseERC20 contract, which would integrate this access control, was not provided. This limitation prevents a comprehensive security assessment of the entire protocol, meaning potential vulnerabilities in the core logic, interactions, or other components of SynapseERC20 could not be identified.

Fix

Provide the complete source code for all relevant contracts, especially the SynapseERC20 token and any other contracts it interacts with, to enable a full and comprehensive security audit. This will allow for a thorough analysis of architectural design, business logic, and inter-contract dependencies.

Status

Unresolved

Medium

Critical Initialization Dependency for Upgradeable Contracts

The AccessControlUpgradeable contract, being an upgradeable component, relies on its __AccessControl_init() or __AccessControl_init_unchained() functions to be called exactly once during the inheriting contract's initialization. Failure to correctly call these initializers in the SynapseERC20 contract's initialize function could lead to an uninitialized state, rendering access control mechanisms ineffective or locking critical functions.M-01

Issue

The AccessControlUpgradeable contract, being an upgradeable component, relies on its __AccessControl_init() or __AccessControl_init_unchained() functions to be called exactly once during the inheriting contract's initialization. Failure to correctly call these initializers in the SynapseERC20 contract's initialize function could lead to an uninitialized state, rendering access control mechanisms ineffective or locking critical functions.

Fix

Ensure that the SynapseERC20 contract's initialize function correctly calls __AccessControl_init() (or __AccessControl_init_unchained() if part of a larger initialization chain) from its constructor or initialize function. Implement robust testing to verify that all upgradeable components are correctly initialized upon deployment.

Status

Unresolved

Low

Centralization Risk of DEFAULT_ADMIN_ROLE

The AccessControlUpgradeable contract's DEFAULT_ADMIN_ROLE possesses the authority to grant and revoke all other roles, including itself. While this is an inherent design of the OpenZeppelin AccessControl pattern, it introduces a single point of failure. If the account(s) holding the DEFAULT_ADMIN_ROLE are compromised or act maliciously, the entire access control system could be subverted.L-01

Issue

The AccessControlUpgradeable contract's DEFAULT_ADMIN_ROLE possesses the authority to grant and revoke all other roles, including itself. While this is an inherent design of the OpenZeppelin AccessControl pattern, it introduces a single point of failure. If the account(s) holding the DEFAULT_ADMIN_ROLE are compromised or act maliciously, the entire access control system could be subverted.

Fix

Implement robust security measures for the account(s) holding the DEFAULT_ADMIN_ROLE. This typically involves using a multi-signature wallet (e.g., Gnosis Safe) with a sufficient number of signers, or integrating it into a decentralized governance mechanism. Regularly review and audit the accounts assigned to this critical role.

Status

Unresolved

Info

Proper Use of Upgradeable Contract Pattern

The contract correctly utilizes OpenZeppelin's Initializable base contract and includes a __gap storage variable. This demonstrates adherence to best practices for building upgradeable contracts, ensuring storage compatibility across different versions when used with a proxy pattern.I-01

Issue

The contract correctly utilizes OpenZeppelin's Initializable base contract and includes a __gap storage variable. This demonstrates adherence to best practices for building upgradeable contracts, ensuring storage compatibility across different versions when used with a proxy pattern.

Fix

Continue to follow OpenZeppelin's upgradeability guidelines strictly for all future contract development and upgrades. Ensure that all state variables are declared before the __gap variable and that initializer modifiers are used correctly.

Status

Unresolved

Info

Leveraging OpenZeppelin Standard Library

The contract extensively uses well-audited and community-vetted OpenZeppelin contracts for its access control logic. This practice significantly reduces the risk of low-level vulnerabilities and common coding errors, as these libraries are maintained and regularly updated by a reputable team.I-02

Issue

The contract extensively uses well-audited and community-vetted OpenZeppelin contracts for its access control logic. This practice significantly reduces the risk of low-level vulnerabilities and common coding errors, as these libraries are maintained and regularly updated by a reputable team.

Fix

Maintain vigilance in keeping OpenZeppelin dependencies updated to their latest stable versions, especially when security patches are released. Regularly review OpenZeppelin's security advisories and release notes.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This audit was conducted on a partial source code fragment, specifically the AccessControlUpgradeable contract, which is a dependency for the SynapseERC20 token. A comprehensive security assessment of the SynapseERC20 contract could not be performed due to the limited scope. The provided code itself is a standard OpenZeppelin implementation, generally considered robust. However, the overall security posture of the SynapseERC20 token depends heavily on its full implementation and integration of this access control.

Technical6/10Medium risk

The provided code, AccessControlUpgradeable, is a well-vetted OpenZeppelin library, indicating a strong foundation for access control (7.2 Code Security). It utilizes standard patterns for role management, reducing the likelihood of common vulnerabilities. However, the audit scope was limited to this fragment, preventing a full assessment of the SynapseERC20 token's core logic, including potential reentrancy, integer overflows, or other contract-specific vulnerabilities (7.1 Architecture).

Governance1/10High risk

The AccessControlUpgradeable contract provides a robust role-based access control system, allowing for granular permission management (7.3 Access Control). This structure can support decentralized governance models if properly configured. However, the DEFAULT_ADMIN_ROLE inherently centralizes significant power, as it can grant and revoke all other roles, including itself (7.5 Governance). The full economic model and its associated risks for the SynapseERC20 token could not be assessed due to the limited code scope (7.4 Economic).

Upgrades1/10High risk

The contract correctly inherits from Initializable and includes a __gap variable, indicating it is designed for use in an upgradeable proxy pattern (7.7 Upgrades). This is a strong practice for future-proofing the protocol. However, proper initialization of the AccessControlUpgradeable contract within the inheriting SynapseERC20 contract is critical; misconfiguration could lead to severe access control issues (7.8 Operations).

Final RecommendationWhat to do about this score

A complete security audit of the entire SynapseERC20 contract, including all its dependencies and business logic, is strongly recommended to identify any potential vulnerabilities not covered by this partial review.

Special attention should be paid to the correct initialization of upgradeable contracts and the management of administrative roles. Ensure that the DEFAULT_ADMIN_ROLE is secured with a robust multi-signature wallet or a well-defined governance process.

Contract & Record

1 audit on record
TypeToken
NetworkEthereum
Token age4y
Contract0x0f2d…9f29
Deployer0x846e…a157
Proxy Upgrade Controls
Proxy TypeEtherscan Detected Custom
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Synapse security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202676High
  2. Jul 23, 202666High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

Is Synapse a scam?

The data indicates a verified contract and renounced ownership, which are positive signals for transparency and decentralization of control over the contract. However, the presence of a mint function and significant token concentration among top holders, alongside unlocked liquidity, introduces considerable risks. While these factors point to potential vulnerabilities, they do not definitively label Synapse as a scam based solely on the provided security data.

Is Synapse safe to buy?

Based on the security analysis, Synapse (SYN) presents several high-risk factors that investors should consider. The existence of a mint function, significant token concentration with the top 10 holders controlling 74.8% of supply, and critically, the absence of locked liquidity contribute to a high-risk score of 66/100. These elements suggest considerable caution is warranted due to potential for market manipulation and liquidity removal.

Has Synapse been audited?

The Synapse contract is verified on-chain, meaning its source code is publicly accessible and matches the deployed version. This allows for transparency and code inspection. While beneficial, this is distinct from a comprehensive third-party security audit, which would rigorously assess for vulnerabilities and economic risks by independent experts.

Related Audits

6 more on the recordAll audits
AutonolasOLAS · Ethereum76HighChipEthereum76HighWoofEthereum76HighPortalEthereum77HighNillionNIL · Ethereum77HightrUSDEthereum75High

Would You Like a More Detailed Audit of Synapse?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page